A hospital's security team detects ransomware on a single radiology workstation. The workstation is not connected to the main patient database, but the hospital's core EHR system is experiencing unusual authentication failures. The incident handler must decide the immediate response. Which action should be taken first?

Immediately power off the radiology workstation to stop the ransomware and then reset all user passwords in the hospital.

Prioritize the EHR authentication failures as the higher-impact incident and investigate them before touching the radiology workstation.

Contain the radiology workstation by disconnecting it from the network and begin collecting its volatile memory.

Disconnect the radiology workstation from the network, preserve its memory, and simultaneously begin triage of the EHR authentication failures to determine if they are related.

A company's incident response team is triaging two incidents: a ransomware infection on a file server used by the finance department and a data breach involving customer credit card information. The company has limited resources. Which incident should be prioritized?

The data breach, because it involves sensitive customer data and may trigger legal notification requirements.

Both incidents equally, because both are serious.

The ransomware infection, because it is actively disrupting the finance department's operations.

The ransomware infection, because it is easier to contain than a data breach.

After containing a malware infection on a single workstation, the incident handler is preparing to eradicate the threat. Which action is most appropriate during the eradication phase?

Reimage the workstation from a known-good backup and apply security patches.

Disconnect the workstation from the network and monitor for further activity.

Delete the malicious files and registry entries manually.

Restore the system to a previous restore point and continue normal operations.

A company's incident response plan includes a communication strategy. During an active incident, which communication is most important for the incident handler to prioritize?

Communicating with the media to provide a public statement.

Communicating with all employees to inform them of the incident.

Communicating with the attacker to negotiate.

Communicating with key stakeholders, including management, legal, and technical teams, to coordinate the response.

After a security incident is fully contained and eradicated, the incident response team is conducting a lessons-learned meeting. What is the primary purpose of this meeting?

To identify improvements to the incident response process and prevent future incidents.

To celebrate the successful containment of the incident.

To document the incident for public release.

To assign blame to the individuals who caused the incident.

GIAC Certified Incident Handler

Domain 1Objective 1

Incident Response and Cyber Investigation GCIH Practice Questions (Page 5)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 21–25

21application · medium
A hospital's security team detects ransomware on a single radiology workstation. The workstation is not connected to the main patient database, but the hospital's core EHR system is experiencing unusual authentication failures. The incident handler must decide the immediate response. Which action should be taken first?
Select an answer first
22expert · hard
A company's incident response team is triaging two incidents: a ransomware infection on a file server used by the finance department and a data breach involving customer credit card information. The company has limited resources. Which incident should be prioritized?
Select an answer first
23application · medium
After containing a malware infection on a single workstation, the incident handler is preparing to eradicate the threat. Which action is most appropriate during the eradication phase?
Select an answer first
24application · medium
A company's incident response plan includes a communication strategy. During an active incident, which communication is most important for the incident handler to prioritize?
Select an answer first
25application · medium
After a security incident is fully contained and eradicated, the incident response team is conducting a lessons-learned meeting. What is the primary purpose of this meeting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.